The experience your organization has had is similar to what many organizations that deal with sensitive information deal with on a regular basis (ie banks, credit bureau's, revenue agencies, etc). Whale Phishing in particular is a nasty attack that takes advantage of these technical weaknesses.
This issue is one that mostly needs to be solved with procedures, as opposed to technical controls. Below are some examples, but these are obviously not completely fool proof nor do they apply to every situation.
- First and foremost establish internal policies and procedures when dealing with any movement of money or sensitive information (Wire Transfers can only be initiated by in-person meetings, orders must be processed after sign off from two people that are in the office, etc) and ensure these are adhered to. This means ensuring that everyone affected internally is aware of these policies and adheres to them.
- Issue communications to relevant stakeholders letting them know that specific communications (such as account breach in the case of banks) will never come from e-mail, or your organization will never request you provide information from links contained within emails.
- You may choose to register domains that may slightly vary on what your domain is to prevent cyber squatting (ex d0main.com / doma1n.com).
- Establish an email address or phone line that people can call to inquire about the authenticity of an email transmission (ie [email protected])
- Put a statement on your website to let relevant parties know of your policies.
It's not exciting but the best way to mitigate these attacks is to establish a firm set of policies and communicating those policies to whoever would need to know them. Let your vendors know that that you'll only place orders through their secure portal (for example).